Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
General
-
Target
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
-
Size
92KB
-
MD5
99ff66d4ab145ca5e2eac34152bce13f
-
SHA1
815a46c79b06426494c0d0ce5a7a66e94202416a
-
SHA256
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1
-
SHA512
f5adce95a87564a49fc1da0882b64ab0e5d079e0535b745d88aeb791935f76ea960a4756ff22d41b23922f958b6ff0f5c56e590d922b9107252f85b1e9ea8e03
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgacotpo:DhAWJGSCTBf12Z1g1otp
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSWOW64\MSDT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\TRACERT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WMIC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\MIGSETUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\EXTRAC32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\LOCATIONNOTIFICATIONS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\PREVHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\BOOTCFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SXSTRACE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKMGR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\CLICONFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\COM\MIGREGDB.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BTH.INF_AMD64_NEUTRAL_E54666F6A3E5AF91\FSQUIRT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\CMDL32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SBUNATTEND.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHINDEXER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\TCMSETUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\WSMANHTTPCONFIG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\CMD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\IEXPRESS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\RRINSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SRDELAYED.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\VERIFIER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\SHARED\IMCCPHR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SETUPSNK.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\PING.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FONTVIEW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SNDVOL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESHARDWARE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\UTILMAN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WINMGMT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\WININIT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\DNSCACHEUGC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CLIP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\COM\COMREPL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\DLLHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\TRACERPT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\MSTSC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\IEXPRESS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\DPLAYSVR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\MIGWIZ.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\MSHTA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMINFO.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KTAB.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBE_UPDATER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\CHROME_PWA_LAUNCHER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMIC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\LIB\VISUALVM\PLATFORM\LIB\NBEXEC64.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\EULA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\NOTIFICATION_HELPER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\EXTCHECK.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KEYTOOL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JABSWITCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KLIST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECOMREGISTERSHELL64.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER64.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KINIT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPDMC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMIREGISTRY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\PACK200.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\CLVIEW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\POWERPNT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SSVAGENT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MAHJONG\MAHJONG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\JOURNAL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\TEMPLATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DW20.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECORE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAFXPACKAGER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\RESOURCE\ICONS\SC_READER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\PPTICO.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OIS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\COMSVCCONFIG\5F1A06C0108B2C81CDE1DC491D74043D\COMSVCCONFIG.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BITS-BITSADMIN_31BF3856AD364E35_6.1.7601.17514_NONE_AB379671230B963F\BITSADMIN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETCFG_31BF3856AD364E35_6.1.7600.16385_NONE_6C23CD5F6B2A8DBC\NETCFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPENFILES_31BF3856AD364E35_6.1.7600.16385_NONE_431B58A8041530AA\OPENFILES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..INBOXGAMES-FREECELL_31BF3856AD364E35_6.1.7600.16385_NONE_B466B741B68BD29A\FREECELL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\CHGUSR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINRE-RECOVERYTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_3142C61B8ADA510F\REAGENTC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_BRMFCMF.INF_31BF3856AD364E35_6.1.7600.16385_NONE_6F8740B92FEA8E01\BRMFRSMG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..X-DIRECTXDIAGNOSTIC_31BF3856AD364E35_6.1.7601.17514_NONE_81E99DA174638311\DXDIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DDODIAG_31BF3856AD364E35_6.1.7600.16385_NONE_924B83B9B69FB351\DDODIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..LINE-USER-INTERFACE_31BF3856AD364E35_6.1.7600.16385_NONE_38DC646BF68909F4\CMDKEY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..COMMANDLINETOOLSMQQ_31BF3856AD364E35_6.1.7600.16385_NONE_851E6308C5B62529\QUSER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\TSKILL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DISPLAYSWITCH_31BF3856AD364E35_6.1.7600.16385_NONE_48B6A2A03E2C7B21\DISPLAYSWITCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LUA_31BF3856AD364E35_6.1.7601.17514_NONE_047062A1736AF5B9\CONSENT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETBT_31BF3856AD364E35_6.1.7601.17514_NONE_BE8ACDD10DE3B1A6\NETBTUGC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NFIGURATION-CMDLINE_31BF3856AD364E35_6.1.7600.16385_NONE_6550A9DE9A702B0F\POWERCFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OS-KERNEL_31BF3856AD364E35_6.1.7601.17514_NONE_CA56670FCAC29CA9\NTOSKRNL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_BF4980401574A899\DISKPERF.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-LPRPORTMONITOR_31BF3856AD364E35_6.1.7601.17514_NONE_1229A6F0546E2346\LPR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TOMIZATIONSNONWINPE_31BF3856AD364E35_6.1.7601.17514_NONE_29F4EED2A5D64C25\PNPUNATTEND.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\PRESENTATIONFONTCAC#\B3ADE8D5C0D4BB5D4940BCAFD3453642\PRESENTATIONFONTCACHE.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MCUPDATE\F30BEBA36940B5A2B55A32EA7F42D694\MCUPDATE.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DISKRAID_31BF3856AD364E35_6.1.7601.17514_NONE_C3AFA97FAE99BBE4\DISKRAID.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7600.16385_NONE_CD7AEEFF1897D018\LODCTR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..DEVICESCONTROLPANEL_31BF3856AD364E35_6.1.7600.16385_NONE_8094BD7B62D2B435\IMAGINGDEVICES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-006E-0409-0000-0000000FF1CE}\MISC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ATIBILITY-ASSISTANT_31BF3856AD364E35_6.1.7600.16385_NONE_8FBB77BB3CD808D1\PCAWRK.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..CE-USERACTIONRECORD_31BF3856AD364E35_6.1.7600.16385_NONE_8EE34C400D95F0AB\PSR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NET1-COMMAND-LINE-TOOL_31BF3856AD364E35_6.1.7601.17514_NONE_E501F8E06B32B48F\NET1.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESTORE-MAIN_31BF3856AD364E35_6.1.7601.17514_NONE_A505D556C9DE886A\RSTRUI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LOCALSESSIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_036AD230212A39CE\LSM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VIRTUALDISKSERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_C910D80F114E267A\VDS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\NARRATOR\0BAE62C3FC6C327ED24989263988173D\NARRATOR.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MICROSOFT.WORKFLOW.COMPILER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LEGACYHWUI_31BF3856AD364E35_6.1.7600.16385_NONE_3E69140A61F1EFF5\HDWWIZ.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\EXPLORER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CSC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ONWIZARDAPPLICATION_31BF3856AD364E35_6.1.7601.17514_NONE_18A11C58AAF4D08C\MIGSETUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_698FC88E65B943D6\WMPCONFIG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPID_31BF3856AD364E35_6.1.7601.17514_NONE_B57215BAC8C6D647\APPIDPOLICYCONVERTER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_6.1.7601.17514_NONE_6F0F7833CB71E18D\APPCMD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_905283BDC3E1D2D8\OOBELDR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\DFSVC\2C3E7FDA8DE40E45E7F5E004094DC7C9\DFSVC.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMSVCHOST\E88DB1688B08FBB889B0B9D4B1A51493\SMSVCHOST.NI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_6.1.7601.17514_NONE_FA8534AB236134C4\RRINSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..ERANDPRINTUI-PMCPPC_31BF3856AD364E35_6.1.7601.17514_NONE_698E475B97512FC9\PUSHPRINTERCONNECTIONS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_6.1.7601.17514_NONE_678566B7DDEA04A5\PKGMGR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\EDMGEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..-SETIEINSTALLEDDATE_31BF3856AD364E35_11.2.9600.16428_NONE_EACE14B8D6178CCA\SETIEINSTALLEDDATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-HTMLAPPLICATION_31BF3856AD364E35_11.2.9600.16428_NONE_3BB1024F1E6BC086\MSHTA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCMDTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_AD5854CA0A23343D\UMOUNT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNDLL32_31BF3856AD364E35_6.1.7600.16385_NONE_33FA4336C49B998B\RUNDLL32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MCUPDATE\6.1.0.0__31BF3856AD364E35\MCUPDATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-INTERNETEXPLORER_31BF3856AD364E35_11.2.9600.16428_NONE_11B913172F0CB26F\IEUNATT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINLOGON_31BF3856AD364E35_6.1.7601.17514_NONE_CDE90685EB910636\WINLOGON.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WRITEWIN_31BF3856AD364E35_6.1.7600.16385_NONE_378836C309EE380E\WRITE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe"C:\Users\Admin\AppData\Local\Temp\58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2896